We are getting the same issue for some customers on our stack but not others.  Trying to figure it out. ... View more

@merrelr You can make that object visible in all apps by exporting it to system     ... View more

Update:  What I had responded is actually incorrect, in that it's not a feature change but actually a bug.  The bug showed up in 8.1.x and fixed in 8.1.6 and apparently in 9.0.x.  But in 8.2.5 and potentially any 8.2.x (have a case currently open as of today 7/18/2022) to make that determination.  So my apologies in the haste of that response as what research I had done in docs and what we were seeing it appeared the functionality had changed. Leaving the below here as to context of my correction.   I believe this behavior changes with 8.2.  The host is no longer being stored on ftr, and if you have host coded in your inputs.conf from prior releases. The clone-prep-clear-config command will not clean out that file in the 8.2.x releases, at least not in 8.2.5 that we are on.  We just ran up on this issue as we have images that our servers are created from and the steps have been to run the clone-prep-clear-config to reset the inputs.conf host values and the guid.  But it no longer clears out the host name from inputs.conf.  So we have had to change our steps as we were not having data come into Splunk under the proper host name.  So now we remove the inputs.conf as well as run the clone-prep-clear-config to reset our servers. ... View more

Windows 2012 and 2012 R2 is supported again from version 8.2.0, until current release as of today, version 9.0.0. According to both docs and download pages https://docs.splunk.com/Documentation/Splunk/9.0.0/Installation/Systemrequirements ... View more

I've hit the same snag on some AMI on AWS. Could not figure out an elegant solution, so I've resorted to: DUPLEX= cat /sys/class/net/$iface/duplex 2>/dev/null | sed 's/./\u&/' ... SPEED= cat /sys/class/net/$iface/speed 2>/dev/null Which redirects the errors to dev null. That was Splunk's implementation back on version 5 of the add-on. ... View more

Have you tried converting the application name into URL-encoded format? In your case you would replace the forward slash character ( ( / ) in your application name with the string %2F. ... View more

Great! I fixed the original answer, so you can accept it. Glad we got it working! ... View more

Try something like this (run anywhere sample) | gentimes start=-1 | eval _raw="{ \"LogName\": \"ExampleLog\", \"CorrelationId\": \"f879095a-0109-4235-8ba8-218f43f27220\", \"LoggingLevel\": \"All\", \"ThreadId\": \"9\", \"LocalTimeStamp\": \"2016-01-28T14:38:36.748986-05:00\", \"AccessModeName\": \"ABC\", \"AgentCode\": \"00000\", \"AgentPrefixCode\": \"CA\", \"ApplicationName\": \"UQ\", \"ChannelCode\": \"DI\", \"CIFCommonSchemaVersionNbr\": \"V0200\", \"CIFGeneratedSchemaId\": \"05c0b8a4-2954-4fb7-a6ae-def569bd4b63\", \"CIFSoftwareVersionNbr\": \"1.2\", \"DataCenterLocationText\": \"None\", \"InstrumentationLogDateTime\": \"/Date(1454070556298)/\", \"LoggingComputerSystemName\": \"mycomputer\", \"LoggingLevelName\": \"Critical\", \"MessageText\": \"Hello world\", \"OperatingEnvironmentName\": \"Development\", \"PartyLogonIdTypeName\": \"None\", \"TransactionDataXML\": \"<application><GUID>0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080</GUID><name>Test</name></application>\", \"TransactionDateTime\": \"2016-01-28T14:38:36.729986-05:00\", \"CIFSchemaValidationErrors\": [ \"AccessModeName should be 10 characters\" ], \"CIFSchemaValidated\": true, \"Custom1\": \"Custom1Value\", \"EventId\": 0, \"CIFUniqueMessageId\": \"f879095a-0109-4235-8ba8-218f43f27220\" }" | table _raw | spath| spath input=TransactionDataXML ... View more